feat: backend project setup with FastAPI structure and dependencies

- Create directory structure per IMPLEMENTATION_PLAN.md Section 12
- Add requirements.txt with FastAPI, SQLAlchemy, CrewAI, etc.
- Add core/config.py for environment variable configuration
- Add core/database.py for SQLite connection
- Add core/security.py for password hashing and JWT
- Add FastAPI app entry point (main.py) with all API routers
- Add Uvicorn runner (run.py)
- Add API route stubs (auth, bots, backtest, simulate, config)
- Add db/models.py with SQLAlchemy models
- Add db/schemas.py with Pydantic schemas
- Add service stubs (ai_agent, backtest, simulate engines)
- Add .env.example with all required environment variables
- Verify server starts correctly

src/backend/app/core/security.py

@@ -0,0 +1,42 @@
+from datetime import datetime, timedelta
+from typing import Any, Optional
+from jose import jwt, JWTError
+from passlib.context import CryptContext
+from .config import get_settings
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    settings = get_settings()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(
+            minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
+        )
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(
+        to_encode, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM
+    )
+    return encoded_jwt
+
+
+def verify_token(token: str) -> Optional[dict[str, Any]]:
+    settings = get_settings()
+    try:
+        payload = jwt.decode(
+            token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM]
+        )
+        return payload
+    except JWTError:
+        return None
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def get_password_hash(password: str) -> str:
+    return pwd_context.hash(password)